~FuCk It!~ DOS[.]exe

General

Target
~FuCk It!~ DOS.exe
Size 328KB
Sample260628-neebpagy7p
SHA256 3c44a0edafe4d6276d7a35db16a06ea11602bc691a24f316135e2dd663c09295
MD5 6da9a48a2c39c662c32d710d48725a6b
SHA1 98d16019589fc4e4926398a6a972f525940fa13c
SHA512 80275a92c456c8749e3d584ed923c98d1241f2a837286442058d176b57e41abf2837edbbf9db73dce4e239043961590bf5e806f959800638964857f853e6142b
SSDEEP 3072:T2uDBCliQVrBFFLD94LOpxrQJSXDRA52B+QkerWe00lzds6FzTtWE:TPpQnfd4LOptSw3B/kerWe001RTtW
TLSH
T110646113E951F80AEA52C0B26B34C16E6D342D335255499333C49E5B6BB2D63F9A0F2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
~FuCk It!~ DOS.exe

File Explorer

~FuCk It!~ DOS.exe

.exe 328KB

~FuCk It!~ DOS.exe

IMPHASH 2bde98d284428a028778599b423b493d
SHA256 3c44a0edafe4d6276d7a35db16a06ea11602bc691a24f316135e2dd663c09295
MD5 6da9a48a2c39c662c32d710d48725a6b
SHA1 98d16019589fc4e4926398a6a972f525940fa13c
SHA512 80275a92c456c8749e3d584ed923c98d1241f2a837286442058d176b57e41abf2837edbbf9db73dce4e239043961590bf5e806f959800638964857f853e6142b
SSDEEP 3072:T2uDBCliQVrBFFLD94LOpxrQJSXDRA52B+QkerWe00lzds6FzTtWE:TPpQnfd4LOptSw3B/kerWe001RTtW
TLSH
T110646113E951F80AEA52C0B26B34C16E6D342D335255499333C49E5B6BB2D63F9A0F2F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13172

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar ord588 __vbaLateIdCall __vbaLenBstr __vbaStrVarMove __vbaFreeVarList __vbaPut3 _adj_fdiv_m64 __vbaRaiseEvent __vbaFreeObjList _adj_fprem1 ord518 __vbaRecAnsiToUni __vbaI2Abs __vbaStrCat __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaExitProc __vbaI4Abs __vbaOnError ord595 __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaBoolVar __vbaStrFixstr __vbaBoolVarNull _CIsin __vbaErase __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError __vbaGet3 __vbaStrCmp ord529 __vbaVarTstEq __vbaGet4 __vbaPutOwner3 __vbaAryConstruct2 __vbaPrintObj __vbaI2I4 DllFunctionCall __vbaVarOr ord563 __vbaFpUI1 __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaR4Var __vbaLateIdCallLd __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface __vbaVarMul __vbaUI1I4 __vbaExceptHandler __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 __vbaVarDiv __vbaFailedFriend __vbaFPException ord717 __vbaStrVarVal __vbaUbound __vbaGetOwner3 __vbaGetOwner4 __vbaCheckType __vbaI2Var __vbaFileSeek ord644 __vbaStopExe ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaNew2 __vbaVar2Vec ord648 ord570 __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList _adj_fdivr_m32 __vbaPowerR8 _adj_fdiv_r ord578 ord685 ord100 __vbaI4Var __vbaVarCmpEq __vbaVarAdd __vbaAryLock __vbaStrToAnsi __vbaStrComp __vbaVarDup __vbaFpI2 __vbaVarCopy __vbaFpI4 ord617 _CIatan __vbaCastObj __vbaAryCopy __vbaStrMove __vbaStrVarCopy __vbaR8IntI4 _allmul _CItan __vbaAryUnlock _CIexp __vbaRecAssign __vbaFreeStr ord580 __vbaFreeObj

Sharing